HCIA---综合实验
一、实验要求
1.ISP路由器只能配置IP地址，之后不得·进行任何配置
2.内部整个网络基于192.168.1.0/24进行地址规划—左边区域就是内部网络
3.R1 R2之间启动ospf协议，单区域
4.PC1–PC4 自动获取IP地址—DHCP
5.PC1不能telnetR1，PC1外的其他内网Pc可以—ACL
6.PC1 —PC4可以访问PC5 ，R2的公网接口只拥有一个公有IP12.0.0.1—NAT
7.外部的client 可以通过域名访问http server----端口映射80
8.isp 路由telnet 12.0.0.1 ，最终成功登录R1—端口映射23
二、实验拓扑
三、IP地址规划
先数清楚有几个广播域，交换机还要先配置，因为VLAN里面还有广播域划分；
需要5个网段，所以需要借3位，用5个网段，还剩3个预留地址作为后期升级使用。
192.168.1.0 /24
- 192.168.1.000 00000 /27—192.168.1.0/27
- 192.168.1.001 00000 /27—192.168.1.32/27
- 192.168.1.010 00000 /27—192.168.1.64/27
- 192.168.1.011 00000 /27—192.168.1.96/27
- 192.168.1.100 00000 /27----192.168.1.128/27
预留地址：
- 192.168.1.101 00000 /27
- 192.168.1.110 00000 /27
- 192.168.1.111 00000 /27
四、路由配置信息
1.先配置交换机：
[sw1]vlan 2
[sw1]vlan 3
[sw1]port-group group-member g0/0/2 to g0/0/3
[sw1-port-group]p l a
[sw1-GigabitEthernet0/0/2]p l a
[sw1-GigabitEthernet0/0/3]p l a
[sw1-port-group]p d v 2
[sw1-GigabitEthernet0/0/2]p d v 2
[sw1-GigabitEthernet0/0/3]p d v 2
[sw1]int g0/0/4
[sw1-GigabitEthernet0/0/4]port link-type access
[sw1-GigabitEthernet0/0/4]port default vlan 3
[sw1]int g0/0/1
[sw1-GigabitEthernet0/0/1]port link-type trunk
[sw1-GigabitEthernet0/0/1]port trunk allow-pass vlan all
[sw2]vlan 2
[sw2]vlan 3
[sw2]int g0/0/2
[sw2-GigabitEthernet0/0/2]port link-type access
[sw2-GigabitEthernet0/0/2]port default vlan 2
[sw2-GigabitEthernet0/0/2]int g 0/0/3
[sw2-GigabitEthernet0/0/3]port link-type access
[sw2-GigabitEthernet0/0/3]port default vlan 3
[sw2-GigabitEthernet0/0/3]int g 0/0/1
[sw2-GigabitEthernet0/0/1]port link-type trunk
[sw2-GigabitEthernet0/0/1]port trunk allow-pass vlan all
2.路由器IP配置
[r1]int g0/0/0.1
[r1-GigabitEthernet0/0/0.1]ip add 192.168.1.33 27
[r1-GigabitEthernet0/0/0.1]dot1q termination vid 2
Feb 7 2022 10:37:46-08:00 r1 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP
on the interface GigabitEthernet0/0/0.1 has entered the UP state.
[r1-GigabitEthernet0/0/0.1]arp broadcast enable
[r1-GigabitEthernet0/0/0.1]int g 0/0/0.2
[r1-GigabitEthernet0/0/0.2]ip add 192.168.1.65 27
[r1-GigabitEthernet0/0/0.2]dot1q termination vid 3
Feb 7 2022 10:38:13-08:00 r1 %%01IFNET/4/LINK_STATE(l)[1]:The line protocol IP
on the interface GigabitEthernet0/0/0.2 has entered the UP state.
[r1-GigabitEthernet0/0/0.2]arp broadcast enable
[r1]int g 0/0/1
[r1-GigabitEthernet0/0/1]ip add 192.168.1.1 30
[r2-GigabitEthernet0/0/1]int g 0/0/0.1
[r2-GigabitEthernet0/0/0.1]ip add 192.168.1.97 27
[r2-GigabitEthernet0/0/0.1]dot1q termination vid 2
[r2-GigabitEthernet0/0/0.1]int g 0/0/0.2
[r2-GigabitEthernet0/0/0.2]ip add 192.168.1.129 27
[r2-GigabitEthernet0/0/0.2]dot1q termination vid 3
[r2-GigabitEthernet0/0/0.2]arp broadcast enable
[r2-GigabitEthernet0/0/0.2]int g 0/0/1
[r2-GigabitEthernet0/0/1]ip add 192.168.1.2 30
[r2-GigabitEthernet0/0/0]int g 0/0/2
[r2-GigabitEthernet0/0/2]ip add 12.0.0.1 24
[r3]int g 0/0/1
[r3-GigabitEthernet0/0/1]ip add 12.0.0.2 24
[r3-GigabitEthernet0/0/1]int g 0/0/0
[r3-GigabitEthernet0/0/0]ip add 1.1.1.1 24
3、PC自动获取IP，做DHCP配置：
[r1]dhcp enable
[r1]ip pool aa
[r1-ip-pool-aa]network 192.168.1.32 mask 27
[r1-ip-pool-aa]gateway-list 192.168.1.33
[r1-ip-pool-aa]dns-list 114.114.114.114
[r1]int g 0/0/0.1
[r1-GigabitEthernet0/0/0.1]dhcp select global
[r2]dhcp enable
[r2]ip pool bb
[r2-ip-pool-bb]network 192.168.1.96 mask 27
[r2-ip-pool-bb]gateway-list 192.168.1.97
[r2-ip-pool-bb]dns-list 114.114.114.114
[r2]ip pool cc
[r2-ip-pool-cc]network 192.168.1.128 mask 27
[r2-ip-pool-cc]gateway-list 192.168.1.129
[r2-ip-pool-cc]dns-list 114.114.114.114
[r2]int g0/0/0.1
[r2-GigabitEthernet0/0/0.1]dhcp select global
[r2-GigabitEthernet0/0/0.1]int g 0/0/0.2
[r2-GigabitEthernet0/0/0.2]dhcp select global
测试可以自动获取IP地址；
4.ospf的配置：
[r1]ospf 1 router-id 1.1.1.1
[r1-ospf-1-area-0.0.0.0]network 192.168.1.0 0.0.0.255
[r2]ospf 1 router-id 2.2.2.2
[r2-ospf-1-area-0.0.0.0]network 192.168.1.0 0.0.0.255
[r2-ospf-1]default-route-advertise always
简单测试一下内网：
5.开启telnet服务：
[r1]aaa
[r1-aaa]local-user an privilege level 15 password cipher 123456
[r1-aaa]local-user an service-type telnet
[r1]user-interface vty 0 4
[r1-ui-vty0-4]authentication-mode aaa
测试：
6、做一个ACL抓取感兴趣流量：
[r1]acl 3000
[r1-acl-adv-3000]rule deny tcp source 192.168.1.61 0.0.0.0 destination 192.168.1
.1 0.0.0.0 destination-port eq 23
[r1-acl-adv-3000]rule deny tcp source 192.168.1.61 0.0.0.0 destination 192.168.1
.33 0.0.0.0 destination-port eq 23
[r1-acl-adv-3000]rule deny tcp source 192.168.1.61 0.0.0.0 destination 192.168.1
.65 0.0.0.0 destination-port eq 23
[r1-acl-adv-3000]display this
[V200R003C00]
#
acl number 3000
rule 10 deny tcp source 192.168.1.61 0 destination 192.168.1.1 0 destination-po
rt eq telnet
rule 15 deny tcp source 192.168.1.61 0 destination 192.168.1.33 0 destination-p
ort eq telnet
rule 20 deny tcp source 192.168.1.61 0 destination 192.168.1.65 0 destination-p
ort eq telnet
#
return
[r1]interface g 0/0/0
[r1-GigabitEthernet0/0/0]traffic-filter inbound acl 3000
因为下面是PC 所以无法测试。
7.做一个nat：
[r2]acl 2000
[r2-acl-basic-2000]rule permit source 192.168.1.0 0.0.0.255
[r2]int g 0/0/2
[r2-GigabitEthernet0/0/2]nat outbound 2000
测试结果：
8、端口映射：
[r2-GigabitEthernet0/0/2]nat server protocol tcp global current-interface 80 i
nside 192.168.1.66 80
Warning:The port 80 is well-known port. If you continue it may cause function fa
ilure.
Are you sure to continue?[Y/N]:y
[r2-GigabitEthernet0/0/2]
测试结果：
9.telnet：
[r2-GigabitEthernet0/0/2]nat server protocol tcp global current-interface 23 in
side 192.168.1.1 23
Warning:The port 23 is well-known port. If you continue it may cause function fa
ilure.
Are you sure to continue?[Y/N]:y
[r2-GigabitEthernet0/0/2]
IA阶段的就此结束，以后接触更多的再和大家分享